Git fixes six vulnerabilities, including code execution during recursive clones

The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepared input.

A vulnerability tracked as CVE-2026-111760 stems from an integer truncation in Git’s handling of its index, and an extremely long file path can pass Git’s safety checks under one name and then be written under a shorter one.

Git now validates that target, along with other reference names and symbolic-reference targets received over protocol v2, closing the hole identified as CVE-2026-113408.

Maintainers recommend that users update to 2.56.1 or the patched release for their series, and that they also update any software that bundles its own copy of Git.

When cloning an empty repository over v2 protocol, Git did not validate the target of the HEAD symbolic reference that a server advertised, so a malicious server could therefore use path-traversal components to make a subsequent branch update, with the files reference backend, write outside the intended reference directory.

Hosting services that perform merges on behalf of users may be exposed, according to the advisory for CVE-2026-114467.

By exploiting this discrepancy, an attacker can replace a submodule’s .git file with a symbolic link pointing to a directory containing malicious configuration or hooks.

This can cause attacker-controlled code to run during a recursive clone.

CVE-2026-105437 affects Git’s merge machinery, where a memory-size calculation can overflow on very large results, such as many conflicts combined with a large conflict-marker-size attribute.

The sixth flaw, CVE-2026-114466, affects git fast-import.

Two submodule-rewriting options could read arbitrary files, potentially leaking contents through error messages, while a third could create or append to files.

The fix rejects overly long index paths before their lengths can be truncated.

A crafted message with more can overflow a fixed-size stack array, causing memory corruption or a crash, for example when someone merges a specially crafted tag.

Git’s roughly 1 GiB limit on patch size checked only the size of the patch as supplied, so a small patch could expand past the limit when decoded and trigger an out-of-bounds read and a crash.